The local SQLite mail cache is not encrypted at rest; encrypted backups and OS-keychain credentials have separate protection. Use device disk encryption when needed.
Native ordinary caches stage incoming messages above 25 MiB after smaller mail and retain exact raw bytes. Encrypted staging, fully streamed reading and mobile/browser equivalents remain open. A snapshot supports up to 256 MiB of original mail. The reader shows long messages 32,000 characters at a time, and Show more advances the requested budget even when HTML markup produces little visible text; refresh and late results preserve expanded pages.
The reader renders static HTML layout with selectable text and a plain-text alternative. Remote images load only after the privacy policy allows them, with bounded downloads, address validation and WebP conversion. Scripts never execute. Related messages are linked by Message-ID, References and In-Reply-To within each account; matching subjects alone do not form a conversation. Only downloaded mail can appear. Advanced browser CSS/animations, invitations and general offline mutation queues remain unsupported.
Gmail mail access currently needs an app password and compatible account settings; Sign in with Google connects Drive/Calendar through Shep's own Desktop OAuth client, not Gmail OAuth. That client is compiled in at build time and no real one exists yet, so current builds show sign-in as not configured and live Google sign-in is unverified; see Google sign-in client. OAuth-only IMAP servers are not supported yet.
Same-account IMAP moves require MOVE; cross-account moves require two IMAP accounts and source UIDPLUS. An upload interrupted before its acknowledgement is retained for manual destination inspection, while a confirmed copy can resume source removal without uploading again. POP3 requires UIDL and never deletes server originals. Background mail checks default to 5 seconds and are configurable from 5–3600 seconds; IMAP IDLE is not implemented yet.
A server Sent lookup uses the exact Message-ID. An absent copy cannot prove that delivery failed, and copying mail after an unacknowledged upload can create duplicates. Outbox requires an explicit review for those cases. Editing recurring CalDAV series is not implemented. Google grant switching, partial permission handling and coordination between independent app processes still need further work.
Automated UI testing currently runs on Linux/X11. Windows/macOS builds are in the dormant CI matrix but have not been executed here. Signed/notarized installers are not included.